Open Recommendations

We recommend that the Deputy Secretary and the Chief Operating Officer require OCIO and FSA to incorporate additional measures to, at a minimum, achieve Level 3 Consistently Implemented status of the ISCM program.

We recommend that the Deputy Secretary require OCIO to automate its capabilities for monitoring the security controls effectiveness and overall implementation of the ISCM Roadmap. (Repeat Recommendation FY 2018 & FY 2019)

We recommend that the Deputy Secretary require OCIO to ensure the completion of Phases 1 and 2 of the CDM program. (Repeat Recommendation FY 2018 & FY 2019)

We recommend that the Deputy Secretary require OCIO to implement a process that ensures data reported on the Cybersecurity Framework Risk Scorecard is accurate.

We recommend that the Deputy Secretary require OCIO to incorporate additional measures to, at a minimum, achieve Level 3 Consistently Implemented status of the Incident Response program.

We recommend that the Deputy Secretary require OCIO to ensure that incidents are consistently submitted to the OIG within the required timeframe.

We recommend that the Deputy Secretary require OCIO to ensure that data loss prevention technologies work as intended for the blocking of sensitive information transmission.

We recommend that the Chief Operating Officer require FSA to incorporate additional measures to, at a minimum, achieve Level 4 Managed and Measurable status of the Contingency Planning program.

We recommend that the Chief Operating Officer require FSA to ensure that contingency plans, and other artifacts impacting contingency plans, are documented and updated in a consistent and timely manner.

Develop and implement procedures within FTA's Triennial and State Management Reviews to assess the necessary data to affirm that each grantee undergoing a comprehensive review carries flood insurance that complies with the FDPA. FTA's suggested corrective actions for any grantee deficiency in this area should include, at a minimum, requiring the grantee to submit to FTA documentation showing proof of flood insurance in the aggregate amount of the maximum available NFIP insurance or the amount of the Federal investment (whichever is less) for all structures required to have it.

U.S. Mint (Mint) management should finalize and implement its bureau-wide privacy program that includes a strategic organizational privacy plan for implementing applicable privacy control and procedures in accordance with National Institute of Standards and Technology (NIST) 800-53. (Recommendation #12)

USAID/Bosnia and Herzegovina's agreement officer determine the allowability of $272, 885 in questioned costs ($241 ineligible and $272,644 unsupported) on pages 10 and 14 of the audit report and recover any amount that is unallowable.

We recommend that OPM perform a gap analysis to identify the monitoring, inventory, and management tools that it needs to implement automated infrastructure management as required by the DCOI and OMB.

We recommend that OPM install automated power metering in all of its data centers in accordance with the requirements in the DCOI.

We recommend that OPM assess the current state of its infrastructure to accurately report data center metrics, including the correct number of data centers (including non-tiered spaces), the correct operational status of data centers, and accurate energy usage.

Perform a review of all Plans of Action and Milestone (POA&M) items closed during the audit period to include supporting documentation and re-approve their closure.

Revise current security weakness management policies and procedures (documenting within a revision history table) to require documented evidence such as calendar appointments, meeting minutes, etc. in support of POA&M closure decisions to be uploaded into CSAM.

Work with the OA CIOs to review current assessment and authorization processes and implement a validation process to ensure updated security plans, ATOs and risk assessments are reviewed and updated to reflect all system (including privacy) controls, vulnerabilities, and that current risks are clearly presented to the authorizing officials.

Work with the OA CIOs to develop mechanisms to ensure updated system security plans and assessments of security controls (that were previously assessed as not satisfied or partially satisfied) reflect current operational environments, including an accurate status of the implementation of system security controls, and all applicable security controls are properly evaluated.

Document OA subnets and OA responsibilities for devices and systems operating on the Common Operating Environment.

Document and implement network segmentation to reduce the attack surface or susceptibility of vulnerable and sensitive OA assets in the Common Operating Environment.

Work with OAs to remediate outstanding identity and access management weaknesses through implementation and closure of POA&Ms and control assessments to determine whether these risks were addressed.

We recommend that the State agency ensure all MCOs implement edits to appropriately reduce or deny claims for other PPCs.

We recommend that the State agency work with the five MCOs to determine the portion of the $16,734,145 that was unallowable for claims containing PPCs and its impact on current- and future-year capitation payment rates.